CVE-2026-63021

Deferred Deferred - Pending Action

Memory Exhaustion in Gitea Swift Package Parser

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63021

EUVD

EUVD-2026-101083

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-63021 is a vulnerability in Gitea's Swift package parser. It allows an authenticated user with package-publish permission to upload a compressed archive containing many small manifests. The parser does not limit the number or total size of these manifests before loading them into memory, causing excessive memory usage that can exhaust system resources or terminate the process.

Detection Guidance

Check Gitea version with 'gitea --version' or via the web interface. If running version 1.27.2 or earlier, the system is vulnerable. Monitor for unusual memory usage or process terminations during Swift package uploads.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive memory or causing request failures. Systems with limited resources are particularly vulnerable. Attackers could exploit it to crash Gitea instances or degrade performance, affecting availability for all users.

Compliance Impact

This vulnerability primarily impacts availability by causing resource exhaustion through excessive memory allocation. While not directly violating GDPR or HIPAA, such disruptions could lead to service unavailability, potentially affecting data access or processing timelines required by these regulations. Organizations relying on Gitea for regulated data handling may face compliance risks if service interruptions occur.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later. Alternatively, restrict Swift package publishing permissions for users or disable Swift package registry access if not needed.

Hi! I’m here to help you understand CVE-2026-63021. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70